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APPLICATION RIGHTS ENABLING 

BACKGROUND 

This invention relates to usage rights associated with computer software applications. 
Computer software applications often exist in two or more versions that can perform different 
sets of functions. It is common for computer software application vendors or manufacturers to 
offer to users a version of the application with a reduced set of functions and a version with a full 
set of functions. The version of the computer software application with a reduced set of 
functions is typically offered for free or at a low cost to the users, while the version with a full set 
of functions is generally more expensive. One example of a computer software application that 
is offered in several versions is the Acrobat® application, manufactured by Adobe Systems Inc. 
of San Jose, California. One version of the application, Acrobat® Reader®, has a reduced set of 
functions, allowing users to view and print platform independent PDF (Portable Document 
Format) formatted documents. Another version of the application, Acrobat® 5.0, has a foil set of 
functions and additionally allows users to convert various document formats into PDF 
documents, add bookmarks, set security options, generate miniature PDF previews, comment on 
and approve PDF documents using digital signatures, add highlights, underlines and notes to 
PDF documents, and so on. 

The existence of more than one version of a computer software application is beneficial 
to users since any user can determine whether he or she is willing to pay the cost for the version 
of the computer software application with a foil set of functions, or if the version with a reduced 
set of functions is sufficient for his or her needs. Furthermore, by making available a reduced 
functionality version of the computer software application, such as Acrobat Reader, for free or at 
a very low cost, the content format used by the application - in this case PDF documents - can 
be propagated as a standard. In other words, many users would refrain from buying a foil 
functionality version of the software, such as Acrobat 5.0, in order to create PDF files if the only 
users that could view the files were people that also had to buy Acrobat 5.0. With a free, limited- 
functionality version, the use of PDF document has been extended to the Internet, because 
authors of PDF documents can rely on that an Acrobat Reader can be obtained by any user with 
Internet access. Many similar examples exist for different types of computer software 
applications and content formats. However, there are also a number of disadvantages and 
inconveniences associated with such a system. 
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A user can receive a file containing electronic data from a content provider, either on 
some type of tangible medium, such as a compact disc or a diskette, or through downloading the 
file over a network, such as the Internet. If the user only has installed the version of the 
computer software application with a reduced set of functions installed on his or her computer, 
the user can only perform a limited set of operations. However, if the user also wishes to 
perform an operation on the content of the file and this operation is not in the reduced set of 
enabled functions, then the user must purchase or in some other way acquire a version of the 
application with the full set of functionality. In some cases, the content provider may request 
that the user performs certain operations. In such a case users are typically unwilling to get the 
more expensive version of the application, in particular if the file or operation will only be used a 
single time only or very infrequently. 

Content providers experience a different set of problems due to the existence of several 
versions of an application. The content provider cannot be sure that all the users will have the 
computer software application with the full set of functions installed on their computers. 
Consequently, the content provider must choose between making available a basic version of the 
content, which only uses the functions that are offered only in the version of the computer 
software application with a reduced set of functions, or making available an advanced version of 
the content, which can use any functionality in the computer software application with a full set 
of functions. In the first scenario, a content provider can reach all users, but can only rely on 
functions in the reduced set of functions. In the second scenario, the content provider can only 
reach a much more limited set of users, but rely on any functions in the full set of functions. 
Alternatively, the content provider can distribute the version of the computer software 
application with the full set of functions for free to the users, but this will typically be very costly 
for the content provider and is therefore often riot a very attractive approach from the content 
provider's point of view. 

Furthermore, computer software application manufacturers must develop multiple types 
of applications that meet the needs of different types of users and different workflows in which 
the products are used. Developing and manufacturing many versions of the same product is 
costly for the application developer and producer. 
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SUMMARY 

In general, in one aspect, this invention provides methods and apparatus, including 
computer program products, implementing and using techniques for controlling capabilities of a 
user software application. A user software application is provided, the user software application 
including a set of disabled operations. Content capable of being operated on by one or more of 
the disabled operations in the set of disabled operations is received. Application rights 
information operable to enable an operation in the set of disabled operations to operate on 
content within a context specified in the application rights information are received and the 
operation in the set of disabled operations is enabled to operate on the received content. 

Advantageous implementations can include one or more of the following features. The 
application rights information can be received with the content on which the operation is to be 
performed. The content can be content of an electronic document and the application rights 
information can be embedded in the document. The application rights information and the 
content on which the operation is to be performed can be received separately. The content can 
be content of an electronic document and the operations in the set of disabled operations can 
include one or more of adding content to the document, adding comments to the document, 
applying a digital signature to the document, saving the document, performing spell-check of the 
document, importing form data, exporting form data, submitting document data to the Internet 
outside a browser environment, and inserting new pages from a template. The document can be 
a PDF document. The content can be content of an electronic document and the application 
rights information can be embedded in the document. The application rights information can be 
unpacked from the document. 

The context specified in the application rights information can include one or more of a 
particular document, a particular type of document, a particular data set, a particular type of data 
set, a particular computer, a particular set of computers, a particular user, a particular set of 
users, a particular session, a particular number of sessions, a particular time period, a particular 
content provider, and a particular document in a particular state. The particular state of the 
particular document in a particular state can be defined by a user. The application rights 
information associated with the received content can be different for different contexts. The 
application rights information can be saved on a computer hosting the computer software 
application. Receiving application rights information can include querying a database for 



Attorney Docket No. : 07844-5 1 800 1 



application rights information and receiving application rights information from the database in 
response to the query. The content can have one or more associated permissions restricting what 
operations can be performed on the content. 

In general, in another aspect, this invention provides methods and apparatus, including 
computer program products, implementing and using techniques for providing content to be 
operated on by a user software application. Content is generated in a format compatible with a 
user software application that includes a set of disabled operations. Application rights 
information is generated for the content. The application rights information is operable to enable 
an operation in the set of disabled operations to operate on the content within a context specified 
in the application rights information. The content and the application rights information are 
distributed to one or more users. 

Advantageous implementations can include one or more of the following features. 
The generated application rights information can be associated with the generated 
content. One or more of the following can be monitored: to how many users the application 
rights information is distributed, the operations enabled for each user, and the context in which 
the operations are enabled for each user. An accounting can be provided to a user software 
application provider based on one or more of the number of users to which the application rights 
information has been distributed, the operations enabled for each user, the context in which the 
operations are enabled for each user, and the number of enabled operations performed by users to 
whom the content and application rights have been distributed. An accounting can be provided 
to a user software application provider based on the context specified in the application rights 
information distributed to the users. The content can be content of an electronic document and 
associating can include embedding the application rights information in the document. 

In general, in another aspect, this invention provides methods and apparatus, including 
computer program products, implementing and using techniques for providing a configurable, 
context-dependent user software application. A user software application including a set of 
disabled operations is provided. The user software application can enable an operation in the set 
of disabled operations to operate on received content based on application rights information. A 
content generation tool is provided. The content generation tool can generate content in a format 
compatible with the user software application and generate application rights information for the 
content. The application rights information identifies one or more operations in the set of 
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disabled operations and can cause the user software application to enable the identified 
operations. The user software application is distributed to one or more users and the content 
generation tool is distributed to one or more content providers for use in generating content and 
application rights information to be distributed to one or more of the users. 

Advantageous implementations can include one or more of the following features. 
Providing a user software application can include providing an application rights management 
module in the user software application. The application rights management module can detect 
whether a context exists in which one or more disabled operations have been made available and 
instruct the user software application to enable the operation within the context. Distributing the 
user software application can include distributing the application rights management module to 
one or more of the users. 

In general, in yet another aspect, this invention provides methods and apparatus, 
including computer program products, implementing and using techniques for providing and 
using configurable, context-dependent user software application. A user software application 
including a set of disabled operations is provided. A content generation tool is provided. The 
content generation tool can generate content and application rights information for the content in 
a format compatible with the user software application. The user software application is 
distributed to one or more users. The content generation tool is distributed to one or more 
content providers. Content is generated in a format compatible with a user software application 
and capable of being operated on by one or more of the disabled operations in the set of disabled 
operations. Application rights information is generated for the content. The application rights 
information can enable an operation in the set of disabled operations to operate on content within 
a context specified in the application rights information. The content and the application rights 
information are distributed to one or more users. The generated content is received. The 
application rights information is received. The operation in the set of disabled operations is 
enabled to operate on the received content. The enabled operation is performed on the received 
content using the user software application. 

The invention can be implemented to realize one or more of the following advantages. A 
user that has installed a computer software application product that supports enablers, and that is 
available for free or offered at a low cost by an application provider, can participate in more 
workflows that may be required by a content provider. A content provider can be certain that all 
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users' computer software applications should be able to perform the same set of operations, 
either because the functionality is enabled by default, or because the functionality can be enabled 
after a user has received an enabler. Consequently, the content provider can provide a single 
version of the content that does not have to be limited to be used in a computer software 
5 application with a reduced set of functions but still be able to reach the same, large number of 
users. 

Application providers can deliver computer software applications with one or more 
standard configurations to users. For example, an application provider can make a "base 
version" of the application available for free, a "low functionality" version of the application 
10 available at a low cost, and a "high functionality" version of the application available at a higher 
cost. In the "base version" a user can, for example, view content without restrictions, but need 
one or more enablers to sign, save, or make comments on content. In the "low functionality 
version," a user can view, sign, save, and make comments on content without restrictions, but 
^ need one or more enablers to perform further operations on the content. In the "high 

fit 15 functionality version" the user can perform any operations, including viewing content, signing, 

hi 

~ saving and commenting on content, creating new content, and any other possible operation 

W without restrictions. 

ry 

ill A content provider can enable different sets of functions in a computer software 

m application for a particular context, that is, certain functions can be enabled for a particular 

ft! 20 document, a particular session or a given number of sessions, while other functions can be 
enabled during a particular time period, for a particular user and/or computer, and so on. 

The details of one or more implementations of the invention are set forth in the accompa- 
nying drawings and the description below. Other features, objects, and advantages of the 
invention will be apparent from the description and drawings, and from the claims. 

25 DESCRIPTION OF DRAWINGS 

FIG. 1 is a schematic diagram showing the relations between an application provider, a 
content provider and a user in accordance with the invention. 

FIG. 2 is a flowchart showing a process from an application provider's point of view for 
providing and distributing a computer software application and a content generation tool to users 
30 and content providers, respectively, in accordance with the invention. 
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FIG. 3 is a flowchart showing a process from a content provider's point of view for 
generating content and application rights information for one or more users in accordance with 
the invention. 

FIG. 4 is a flowchart showing a process from a user's point of view for performing 
5 operations on received content using a computer software application on a user's computer in 
accordance with the invention. 

FIG. 5 is a flowchart showing another process from a user's point of view for performing 
operations on received content using a computer software application on a user's computer in 
accordance with the invention. 
10 FIG. 6 is a schematic view of a content file with associated application rights and 

permissions in accordance with the invention, 
h Like reference symbols in the various drawings indicate like elements. 

Teats' " 

g DETAILED DESCRIPTION 

J: The invention can be described by way of example from three different aspects: an 

i y 

W 15 application provider's point of view, a content provider's point of view, and a user's point of view 

8 

p An overview (100) of the relations between an application provider (105), a content provider 

(11 0), and a user ( 1 1 5), is schematically shown in FIG. 1 . The application provider ( 1 05), the 
M content provider (110), and the user ( 1 1 5) are typically located in different geographical 

pi locations, but may alternatively be located at the same physical location. 

20 The application provider (105) provides a computer software application (125), also 

referred to as a user software application, to be distributed to one or more users and a content 
generation tool (120) to be distributed to the content provider (110). The computer software 
application (125) is typically an introductory level computer software application that is provided 
for free or at a low cost for the users. The computer software application (125) has a set of 
25 enabled default functions that a user can use in any context, and a set of additional functions that 
are not enabled by default. 

The content generation tool (120) allows a content provider to enable one or more 
functions in the set of additional functions, within a particular context, in the user's computer 
software application. One mechanism for enabling functions is to generate enablers (130) with 
30 the content generation tool (120) and distribute these enablers (130) to one or more users. When 
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an enabler has been installed on a user's computer, the enabler can enable one or more of the 
additional functions included in the user's computer software application, within a context that is 
specified in the enabler (130). The content generation tool (120) can also be used by the content 
provider (110) to generate content (135) ) in a format compatible with the user software 
application and, if the content provider wishes to do so, associate one or more enablers with a 
particular piece or type of generated content. The enabler (130) and the content (135) can be 
requested by and/or distributed to one more users (115), separately or together, on a tangible 
medium or over a communications network such as the Internet. The enabler (130) and the 
content (135) will be described in further detail below. After the user has obtained the computer 
software application, the enabler and the content, the user can perform operations on the received 
content (135a) that have been enabled by the enabler (130a) and provided to the user (115) by the 
content provider (110). 

The invention will now be described in further detail, by way of example, from the point 
of view of the application provider (105), the content provider (110), and the user (1 1 5). It 
should be clear that many variations that fall within the scope of the invention are possible. 

Application provider's view 

FIG. 2 shows a process (200) from an application provider's point of view for providing 
and distributing a computer software application and a content generation tool to users and 
content providers, respectively. The application provider provides a computer software 
application (205). The computer software application can either be manufactured by the 
application provider or can be manufactured by some other entity and be distributed to different 
users by the application provider. The computer software application can be a single application 
or be a collection of smaller "sub-applications" or services that work together to form an 
application. As was described above, the computer software application can be made available 
for free or at low cost to users and contains a set of enabled default functions that are available 
for unrestricted use by a user. In addition to the set of enabled default functions, the computer 
software application also contains a set of additional functions that are not enabled by default, 
but that can be enabled with further authorization. The additional functions can be enabled 
within a specific context, such as for a predetermined period of time, for a specific document, for 
a specific computer, for a specific user, and so on. How functions are enabled will be described 

8 
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in further detail below when the content provider's and user's aspects of the invention are 
discussed. 

The application provider also provides a content generation tool (210). The content 
generation tool can be implemented as a software and/or firmware module and can either be 
provided as a feature in the computer software application (125), or be provided as a separate 
stand-alone product. The content generation tool can be used by a content provider to generate 
content that can be operated on by users using the computer software application (125). The 
content generation tool can also be used, as described above, to generate enablers that can enable 
one or more additional functions in a user's computer software application within a given 
context. Examples of different contexts will be further described below when the role of the 
content provider is discussed. 

Copies of the computer software application are distributed to one or more users (215) 
and copies of the content generation tool are distributed to one or more content providers (220). 
The distribution of the computer software application and of the content generation tool can, for 
example, occur over the Internet or on some form tangible medium, such as a diskette or CD 
ROM. The distribution can take place as a sale, a promotional offer, or through any conventional 
business method. The distribution does not necessarily require sending the entire computer 
software application to the user's computer. For example, in some implementations the users can 
receive only components of the computer software application that are necessary to communicate 
over a network with a server or computer hosting the application. 

After the application provider has distributed the computer software application and the 
content generation tool, the application provider receives information from the content providers 
(225). This information typically includes one or more of the number of users to which the 
content has been delivered, which operations have been enabled, and the context within which 
the operations have been enabled. One or more pieces of this information serves as a basis for an 
accounting from the content providers to the application provider, as a compensation for 
enabling functions of the computer software application on the users' computers. Finally, based 
on the information provided, the application provider receives an accounting from the content 
providers (230). How this is done will be described in further detail below when the content 
provider's role is discussed. 
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In a different implementation of the invention, steps 225 and 230 are optional and depend 
on what type of agreement the content provider has with the application provider. For example, 
some content providers may be given an unlimited license by the application provider to generate 
and distribute content and application rights, while other content providers' freedom may be 
more restricted and they may have to report back to the application provider, as described above. 

Content provider's view 

FIG. 3 shows a process (300) from a content provider's point of view for generating 
content and application rights information for one or more users. The content provider uses a 
content generation tool received from the application provider, as described above, to generate 
content to be distributed to users (305). The content provider also generates application rights 
information (310), using the content generation tool. Application rights refer to rights that are 
associated with processes or operations that can be carried out by a user application. Application 
rights can be, but do not have to be associated with specific content. In addition to the 
application rights, a content provider (or author) may associate one or more permissions with a 
particular piece of content (for example, a document or portion thereof). Permissions are 
content-specific and restrict what operations can be carried out by a user application. For 
example, the content provider may set up permissions allowing a user to copy a document, but 
not print the document. Permissions can override application rights, so that even if a particular 
user's software application is enabled to perform a particular operation, permissions associated 
with a particular document or piece of content can prevent a user from performing the operation 
for that particular document. 

In one implementation, the application rights information is implemented as a set of 
certified authorizations expressed in a rights language. That the authorizations are certified 
means that the application rights and the context in which the application rights apply are signed 
by an entity, such as a content provider, that has been certified by another different entity, such as 
an application provider, to create and modify such application rights. 

Application rights information can be required to comply with certain rules. Rules can 
provide, for example, that users can be authorized to make certain modifications to content, but 
that "unreasonable modifications," such as replacing all pages in a document, can only be 
performed by a certified content provider. Another example is that only certified content 

10 
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providers may copy a rights dictionary, which will be discussed in further detail below, from one 
document to another document. Yet another example is that only content providers may add 
rights information to existing rights information for certain content. This prevents users from 
engaging in the extension of their rights or transmission of rights to others without authorization 
5 (e.g., without providing for an accounting to the application provider from the content provider 
or user). The authorization can be performed using standard cryptographic techniques, such as 
public and private keys. 

The application rights information is also referred to as an enabler, as was described 
above. The application rights information, or enabler, can be embedded into a variety of 
10 common content formats, or provided as one or more separate files. The enabler is signed with a 
j«* private key by the content provider, or some other authorized entity, and contains a description of 

q what rights the user has, and the context within which the rights are applicable. The context of 

pj an enabler is flexible and can, for example, include: applies only to this document, applies only 

H to this session or a set number of sessions, applies for a given number of uses, applies in a 

ru 

m 15 particular time window, applies only to a specific computer or user, and so on. 
%, After th e content and application rights information hve been generated, the application 

rights information is attached to the content (3 1 5). The application rights information can be 
attached by any conventional method, such as embedded into the content file, or included in one 
g or more separate files that are attached to the content file. In another implementation, the 

20 application rights information is not attached to the content file, but provided as one or more 

separate files in addition to the content file. FIG. 6 shows a schematic view of a file (600) that 
has embedded application rights information (605), permissions information (610) and content 
(615). In one implementation, the application rights information (605) includes an enumeration 
or dictionary of rights (that is, what rights are associated with the content), a hash of the file, and 
25 a signature of the rights dictionary, such as a public-private key pair or other similar way of 
authenticating a user. This allows the content provider to give different users different 
application rights. The hash is based on the content of the file and is created according a suitable 
conventional hashing algorithm. Every time a document or piece of content is changed a new 
hash is generated and compared with the previous one. If the document or content is 
30 significantly changed, the new hash will differ from the previous one. Significant changes can 
be, for example, replacing all, or almost all pages of a document with new pages having different 

11 
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content. The hashing algorithm can for example detect this by using the first and last page of a 
document in creating the hash. Only certified content providers are allowed to make significant 
changes, which prevents a user from acting as a content provider. The permissions information 
(610) include an enumeration of permissions and optionally a password that may be required for 
5 the user to decrypt the content (615) of the file if the content has been encrypted by the content 
provider. 

Next, as can be seen in FIG. 3, the content provider distributes the content and the 
application rights information to one or more users (320), either separately or together with the 
application rights information, depending on how the content and application rights information 
10 are represented. The content provider can keep, depending on what types of agreement the 

content provider has with the application provider, a count of how many copies of the content 
and application rights information have been distributed to the users, and what rights have been 

o 

GO enabled. Finally, the content provider provides an accounting to the application provider based 

O 

if i on the number of users and the context in which the content provider has enabled the disabled 

P*j 15 functions in the computer software application on the users' computers (330). 

by 

The above example of providing information and an accounting to the application 

C! 

S'l provider is just an example of how this is done in one implementation of the invention. In a 

|*| different implementation, the content provider provides an accounting to the application provider 

Q when the content provider attaches application rights information to the content file. In yet 

flli 

" * 20 another implementation, the content provider can receive modified content back from the users, 
and provide information and an accounting to the application provider based on the number of 
returned copies of the content. One example of such a situation is if a content provider sends out 
an empty application form to be filled in and returned by the users. 

The rights that a content provider can put in an enabler, and the rights of the content 
25 provider in general with respect to the generation of enablers and content, can further be 

controlled by a set of rules or assertions that are enforced by standard cryptographic techniques, 
such as a certification process based on public key cryptography. As in FIG. 2, in a different 
implementation of the invention, steps 325 and 330 are optional and depend on what type of 
agreement the content provider has with the application provider. 

30 
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User's view 

FIG. 4 shows a process (400) from a user's point of view for performing operations on 
received content using a computer software application on a user's computer. It is assumed that 
the user has already obtained and installed the computer software application from the 
5 application provider. The user receives content (405) from a content provider. The user 

application has a built-in hashing algorithm and a public key. The received content is checked to 
verify the content and application rights - for example, by confirming that the application rights 
dictionary is intact (i.e., that it has not been modified without authorization) and signed by the 
appropriate private key. The built-in hashing algorithm is also run on the received content and 
1 o the result is compared with the hash provided in the document to detect whether the document 
has been significantly changed after it was prepared by the content provider. If all these tests are 
successful, the user software application can be certain that the content originates from a 
certified content provider. 

The user also receives application rights information (410) in the form of one or more 
*j 15 enablers. The receipt of the one or more enablers can occur before, simultaneously with, or after 
III the receipt of the content, since the enablers are typically stored in a predetermined location on 

5*! the user's computer, or in a remote location that is accessible for the computer software 

application on the user's computer and will be accessed from this location independently of 
when they arrived there. The process then receives an input requesting the computer software 
pg| 20 application to perform an operation on the received content (415). The input can be generated by 
a user, or by the received content itself. If the received document is a PDF document, as 
described above, the operations can be to view the document, print the document, add comments 
to the document, digitally sign the document, and so on. 

The process then checks if the operation belongs to the set of enabled default operations 
25 in the computer software application (420). If the operation belongs to the set of enabled default 
operations, the process performs the operation on the content (425). If the operation does not 
belong to the set of enabled default operations, the process checks if in an enabler exists for the 
desired operation (430), that is, if the content provider has given the user the necessary rights to 
perform this additional operation on the content. In one implementation, the process performs 
30 the check by consulting an Application Rights Management (ARM) authority module in the 
computer software application. The ARM module can, at any point in time, determine which 

13 
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features are available for use by the user, by detecting the presence of enablers, for example, in 
the content file or document, or in one or more separate license files residing on the user's 
computer or at a remote location where the application rights information for that particular user 
is stored. If no enablers are detected, the process denies the user access to the requested 
operation (435). If there is an enabler for the requested operation, the process enables the 
additional operation within the context specified by the application rights information (440). 
Finally, the enabled operation is performed on the content (445). 

FIG. 5 shows an alternative process (500) from a user's point of view for performing 
operations on received content using a computer software application on a user's computer. Also 
here, it is assumed that the user has already obtained and installed the computer software 
application from the application provider. The user receives content (505) from a content 
provider and application rights information (510) in the form of one or more enablers, as was 
discussed above with FIG. 4. All the enabled operations in the current context are then indicated 
to the user (515). In one implementation the enabled operations are indicated to the user by 
making menu items, toolbar buttons, and so on, available for a user to click on when an enabler 
for the current context is present. The process then receives a user selection requesting the 
computer software application to perform an enabled operation on the received content (520), for 
example, by a user clicking with a mouse on an enabled menu item or toolbar button. Finally, 
the selected operation is performed on the content (525). 

The invention can be implemented in digital electronic circuitry, or in computer 
hardware, firmware, software, or in combinations of them. Apparatus of the invention can be 
implemented in a computer program product tangibly embodied in a machine-readable storage 
device for execution by a programmable processor; and method steps of the invention can be 
performed by a programmable processor executing a program of instructions to perform 
functions of the invention by operating on input data and generating output. The invention can 
be implemented advantageously in one or more computer programs that are executable on a 
programmable system including at least one programmable processor coupled to receive data and 
instructions from, and to transmit data and instructions to, a data storage system, at least one 
input device, and at least one output device. Each computer program can be implemented in a 
high-level procedural or object-oriented programming language, or in assembly or machine 
language if desired; and in any case, the language can be a compiled or interpreted language. 
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Suitable processors include, by way of example, both general and special purpose 
microprocessors. Generally, a processor will receive instructions and data from a read-only 
memory and/or a random access memory. Generally, a computer will include one or more mass 
storage devices for storing data files; such devices include magnetic disks, such as internal hard 
disks and removable disks; magneto-optical disks; and optical disks. Storage devices suitable for 
tangibly embodying computer program instructions and data include all forms of non-volatile 
memory, including by way of example semiconductor memory devices, such as EPROM, 
EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable 
disks; magneto-optical disks; and CD-ROM disks. Any of the foregoing can be supplemented 
by, or incorporated in, ASICs (application-specific integrated circuits). 

To provide for interaction with a user, the invention can be implemented on a computer 
system having a display device such as a monitor or LCD screen for displaying information to 
the user and a keyboard and a pointing device such as a mouse or a trackball by which the user 
can provide input to the computer system. The computer system can be programmed to provide 
a graphical user interface through which computer programs interact with users. 

A number of embodiments of the invention have been described. Nevertheless, it will be 
understood that various modifications may be made without departing from the spirit and scope 
of the invention. For example, a user can receive content and enablers in any order. There may 
be multiple content providers, of which some only generate enablers and others only generate 
content. An operation requested by a user or by content may not have access rights that are 
immediately granted, and can request that the user connects to a remote server to dynamically 
obtain the necessary application rights for that particular operation. The entity certifying the 
content providers to create application rights does not have to be the application provider, but 
can be a different entity that controls what different content providers are allowed to do. The 
selection of operations to be performed on received content does not have to be made directly by 
a user. Instead, the selection of operations can be directed by the computer software application 
or some sort of help or guidance system for the user, which takes the user proactively through the 
various steps that need to be performed. Application rights can be added to a document or other 
type of content on a sub-document level, for example, pages, or individual objects on the page. 
Additional public and private key pairs can be provided to users together with content to tailor 
application rights associated with the content. Application rights can be given dynamically to 
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users in response to some user action or document state. For example, if a user receives a form, 
the user may originally have the rights to fill in blank spaces, and upon completion of all 
required blank spaces receive the rights to sign and submit the form. Accordingly, other 
embodiments are within the scope of the following claims. 
5 What is claimed is 
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